@ex-machina/opencode-anthropic-auth 2.0.0-next.2 → 2.0.0-next.3

package/README.md

@@ -114,9 +114,9 @@ The plugin reads the following environment variables:
 - **`ANTHROPIC_INSECURE`** — Skips TLS certificate verification. Behavior differs by OpenCode version:
     - **OpenCode v1** — Set to `1` or `true` to skip verification. Only effective when `ANTHROPIC_BASE_URL` is also set.
     - **OpenCode v2** — Not supported. OpenCode v2 plugin request hooks cannot disable TLS verification. If set, the plugin logs a warning and leaves verification enabled; requests to an untrusted or self-signed `ANTHROPIC_BASE_URL` will fail.
-- **`ANTHROPIC_CLAUDE_CODE_VERSION`** — Overrides the Claude Code version reported to Anthropic for both release lines. Must be `major.minor.patch` (for example, `2.1.275`). Defaults to the bundled version; a malformed value logs an actionable error without echoing its contents, and the bundled version is used instead. A value older than the bundled version is honored but logs a warning, since reporting an older version can make newer models reject the request. Read once when the plugin loads, so restart OpenCode after changing it.
+- **`ANTHROPIC_CLAUDE_CODE_VERSION`** — Overrides the Claude Code version reported to Anthropic for both release lines. Must be `major.minor.patch` (for example, `2.1.280`). Defaults to the bundled version; a malformed value logs an actionable error without echoing its contents, and the bundled version is used instead. A value older than the bundled version is honored but logs a warning, since reporting an older version can make newer models reject the request. Read once when the plugin loads, so restart OpenCode after changing it.
 
-Anthropic gates model access on the reported Claude Code version server-side, returning a 400 `claude_code_version_too_old` error for models that require a newer client. `ANTHROPIC_CLAUDE_CODE_VERSION` lets you raise the reported version without waiting for a plugin release.
+Anthropic gates model access on the reported Claude Code version server-side, returning a 400 `claude_code_version_too_old` error for models that require a newer client. On OpenCode v2, when the exact structured rejection names a newer minimum, the plugin adopts that real version for the rest of the process and retries the initial request once. Other 400 responses and valid explicit `ANTHROPIC_CLAUDE_CODE_VERSION` overrides are never changed automatically. A malformed override is ignored, so its bundled fallback remains eligible for exact-response recovery. The override remains an escape hatch for both release lines.
 
 ## How It Works
 

package/dist/config.d.ts

@@ -7,6 +7,16 @@
  * waiting for a published bump.
  */
 export declare const ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR = "ANTHROPIC_CLAUDE_CODE_VERSION";
+export declare function isValidClaudeCodeVersion(candidate: string): boolean;
+/**
+ * Compare two validated Claude Code releases.
+ *
+ * Components are compared numerically rather than lexically — `2.1.99` sorts
+ * after `2.1.280` as a string but is the older release — and as `BigInt`, so a
+ * large bounded component cannot silently lose precision the way `Number`
+ * would. Invalid input has no ordering and returns `undefined`.
+ */
+export declare function compareClaudeCodeVersions(candidate: string, baseline: string): -1 | 0 | 1 | undefined;
 /**
  * Outcome of reading the version override.
  *

package/dist/config.js

@@ -11,20 +11,27 @@ export const ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR = 'ANTHROPIC_CLAUDE_CODE_VERS
 /**
  * Claude Code releases are `major.minor.patch` with numeric components.
  *
- * Leading zeros are rejected: `02.1.275` is not a release Anthropic publishes,
+ * Leading zeros are rejected: `02.1.280` is not a release Anthropic publishes,
  * so accepting it would report a version string no server-side gate expects.
  */
 const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 const MAX_VERSION_LENGTH = 64;
+export function isValidClaudeCodeVersion(candidate) {
+    return (candidate.length <= MAX_VERSION_LENGTH && VERSION_PATTERN.test(candidate));
+}
 /**
- * Is `candidate` an older Claude Code release than `baseline`?
+ * Compare two validated Claude Code releases.
  *
- * Both arguments must already match `VERSION_PATTERN`. Components are compared
- * numerically rather than lexically — `2.1.99` sorts after `2.1.275` as a
- * string but is the older release — and as `BigInt`, so an unbounded component
- * cannot silently lose precision the way `Number` would.
+ * Components are compared numerically rather than lexically — `2.1.99` sorts
+ * after `2.1.280` as a string but is the older release — and as `BigInt`, so a
+ * large bounded component cannot silently lose precision the way `Number`
+ * would. Invalid input has no ordering and returns `undefined`.
  */
-function isOlderVersion(candidate, baseline) {
+export function compareClaudeCodeVersions(candidate, baseline) {
+    if (!isValidClaudeCodeVersion(candidate) ||
+        !isValidClaudeCodeVersion(baseline)) {
+        return undefined;
+    }
     // The `0n` defaults are unreachable — `VERSION_PATTERN` guarantees exactly
     // three components — but they keep the destructuring free of assertions.
     const [major = 0n, minor = 0n, patch = 0n] = candidate
@@ -34,10 +41,12 @@ function isOlderVersion(candidate, baseline) {
         .split('.')
         .map((part) => BigInt(part));
     if (major !== baseMajor)
-        return major < baseMajor;
+        return major < baseMajor ? -1 : 1;
     if (minor !== baseMinor)
-        return minor < baseMinor;
-    return patch < basePatch;
+        return minor < baseMinor ? -1 : 1;
+    if (patch !== basePatch)
+        return patch < basePatch ? -1 : 1;
+    return 0;
 }
 /**
  * Resolve the Claude Code version to report to Anthropic.
@@ -54,7 +63,7 @@ export function resolveClaudeCodeVersion(raw = process.env[ANTHROPIC_CLAUDE_CODE
         return { type: 'success', version: CLAUDE_CODE_VERSION };
     }
     const trimmed = raw.length <= MAX_VERSION_LENGTH ? raw.trim() : '';
-    if (!VERSION_PATTERN.test(trimmed)) {
+    if (!isValidClaudeCodeVersion(trimmed)) {
         return {
             type: 'invalid',
             error: `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} is not a valid Claude Code version. ` +
@@ -63,7 +72,7 @@ export function resolveClaudeCodeVersion(raw = process.env[ANTHROPIC_CLAUDE_CODE
                 `${ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR} and restart OpenCode to use the override.`,
         };
     }
-    if (isOlderVersion(trimmed, CLAUDE_CODE_VERSION)) {
+    if (compareClaudeCodeVersions(trimmed, CLAUDE_CODE_VERSION) === -1) {
         return {
             type: 'outdated',
             version: trimmed,

package/dist/constants.d.ts

@@ -22,7 +22,7 @@ export declare const CCH_POSITIONS: number[];
  * newer is required"). Keep this at or above the latest published
  * `@anthropic-ai/claude-code` release, otherwise new models are unreachable.
  */
-export declare const CLAUDE_CODE_VERSION = "2.1.275";
+export declare const CLAUDE_CODE_VERSION = "2.1.280";
 export declare const CLAUDE_CODE_ENTRYPOINT = "sdk-cli";
 /**
  * Build the `user-agent` value for a reported Claude Code version.

package/dist/constants.js

@@ -32,7 +32,7 @@ export const CCH_POSITIONS = [4, 7, 20];
  * newer is required"). Keep this at or above the latest published
  * `@anthropic-ai/claude-code` release, otherwise new models are unreachable.
  */
-export const CLAUDE_CODE_VERSION = '2.1.275';
+export const CLAUDE_CODE_VERSION = '2.1.280';
 export const CLAUDE_CODE_ENTRYPOINT = 'sdk-cli';
 /**
  * Build the `user-agent` value for a reported Claude Code version.

package/dist/index.js

@@ -2,10 +2,11 @@ import { createHash, createHmac, randomBytes } from 'node:crypto';
 import { Plugin } from '@opencode/plugin';
 import { authorize, exchange, refreshToken } from "./auth.js";
 import { BodyLimitError, contentLength, readBoundedText } from "./bounded.js";
-import { resolveClaudeCodeVersion } from "./config.js";
-import { CLAUDE_CODE_VERSION, REQUIRED_BETAS } from "./constants.js";
+import { ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR, compareClaudeCodeVersions, isValidClaudeCodeVersion, resolveClaudeCodeVersion, } from "./config.js";
+import { CLAUDE_CODE_VERSION, formatUserAgent, REQUIRED_BETAS, } from "./constants.js";
 import { createConnectionLabel, describeConnection, enhanceRateLimitResponse, } from "./rate-limit.js";
 import { createStrippedStream, headersAfterBodyTransform, isInsecure, isTrustedAnthropicUrl, mergeHeaders, rewriteRequestBody, rewriteUrl, setOAuthHeaders, ToolNameAliasTable, } from "./transform.js";
+import { detectClaudeCodeVersionRejection } from "./version-rejection.js";
 const PLUGIN_ID = 'ex-machina.anthropic-auth';
 const INTEGRATION_ID = 'anthropic';
 const REFRESH_CACHE_GRACE_MS = 30_000;
@@ -25,6 +26,7 @@ const CONNECTION_TRACKING_TTL_MS = 5 * 60_000;
 const MAX_ACTIVE_RESPONSE_TRANSFORMS = 256;
 const MAX_RECONSTRUCTED_ALIAS_LOOKUPS = 32;
 const MAX_TRACKED_REQUEST_URL_BYTES = 8 * 1024;
+const MAX_VERSION_GATE_RECOVERIES = 256;
 const UNKNOWN_CONNECTION = 'Unknown OAuth connection';
 const AMBIGUOUS_CONNECTION = 'Ambiguous OAuth connection';
 // setup() is location-scoped while the credential store is process-global.
@@ -175,22 +177,47 @@ function warnIfInsecureUnsupported() {
         'ANTHROPIC_BASE_URL endpoint. TLS verification remains enabled — ' +
         'requests to an untrusted/self-signed endpoint will fail.');
 }
+function versionGateRecoveryKey(sessionID, agent, providerID, modelID) {
+    return `${sessionID}\u0000${agent}\u0000${providerID}\u0000${modelID}`;
+}
+/** Read the exact Claude Code version carried by a plugin-owned request. */
+function sentClaudeCodeVersion(request) {
+    const userAgent = request.headers.get('user-agent');
+    if (!userAgent?.startsWith('claude-cli/'))
+        return undefined;
+    const suffix = ' (external, cli)';
+    if (!userAgent.endsWith(suffix))
+        return undefined;
+    const version = userAgent.slice('claude-cli/'.length, -suffix.length);
+    return isValidClaudeCodeVersion(version) &&
+        formatUserAgent(version) === userAgent
+        ? version
+        : undefined;
+}
 export default Plugin.define({
     id: PLUGIN_ID,
     setup: async (ctx) => {
         warnIfInsecureUnsupported();
         // Resolve once so user-agent and billing metadata agree for every request
         // handled by this plugin generation.
-        const versionResolution = resolveClaudeCodeVersion();
+        const rawVersionOverride = process.env[ANTHROPIC_CLAUDE_CODE_VERSION_ENV_VAR];
+        const versionResolution = resolveClaudeCodeVersion(rawVersionOverride);
         if (versionResolution.type === 'invalid') {
             console.error(`[ex-machina.anthropic-auth] ${versionResolution.error}`);
         }
         else if (versionResolution.type === 'outdated') {
             console.warn(`[ex-machina.anthropic-auth] ${versionResolution.warning}`);
         }
-        const claudeCodeVersion = versionResolution.type === 'invalid'
+        let claudeCodeVersion = versionResolution.type === 'invalid'
             ? CLAUDE_CODE_VERSION
             : versionResolution.version;
+        // A valid explicit override is absolute. Automatic adoption is only the
+        // fallback path for an unset (or malformed and therefore ignored) value.
+        const hasExplicitVersionOverride = rawVersionOverride !== undefined && versionResolution.type !== 'invalid';
+        // This set is only an at-most-once limiter. The exact response is marked
+        // retryable below, so this key never authorizes an unrelated retry event.
+        // On overflow, recovery fails closed rather than forgetting old entries.
+        const versionGateRecoveries = new Set();
         const aliasesByRequest = new WeakMap();
         const aliasesByFingerprint = new Map();
         const transformedRequests = new WeakSet();
@@ -584,6 +611,29 @@ export default Plugin.define({
             if (!event.response.ok) {
                 if (lease)
                     releaseAliasLease(event.request, lease);
+                if (!hasExplicitVersionOverride && event.response.status === 400) {
+                    const sentVersion = sentClaudeCodeVersion(event.request);
+                    const rejection = sentVersion
+                        ? await detectClaudeCodeVersionRejection(event.response, sentVersion)
+                        : undefined;
+                    if (rejection) {
+                        if (compareClaudeCodeVersions(rejection.requiredVersion, claudeCodeVersion) === 1) {
+                            claudeCodeVersion = rejection.requiredVersion;
+                        }
+                        const key = versionGateRecoveryKey(event.sessionID, event.agent, event.model.providerID, event.model.id);
+                        if (!versionGateRecoveries.has(key) &&
+                            versionGateRecoveries.size < MAX_VERSION_GATE_RECOVERIES) {
+                            versionGateRecoveries.add(key);
+                            const headers = new Headers(event.response.headers);
+                            headers.set('x-should-retry', 'true');
+                            event.response = new Response(event.response.body, {
+                                status: event.response.status,
+                                statusText: event.response.statusText,
+                                headers,
+                            });
+                        }
+                    }
+                }
                 if (event.response.status === 429) {
                     const enhanced = await enhanceRateLimitResponse(event.response, connectionForRequest(event.request));
                     event.response = enhanced.response;
@@ -620,6 +670,7 @@ export default Plugin.define({
                 clearTimeout(entry.timer);
             }
             connectionByAuthorization.clear();
+            versionGateRecoveries.clear();
             for (const timer of refreshCacheTimers.values())
                 clearTimeout(timer);
             refreshCacheTimers.clear();

package/dist/version-rejection.d.ts

@@ -0,0 +1,17 @@
+export interface ClaudeCodeVersionRejection {
+    readonly rejectedVersion: string;
+    readonly requiredVersion: string;
+}
+/**
+ * Parse only Anthropic's structured minimum-version rejection.
+ *
+ * The error code is authoritative; the bounded message supplies the versions.
+ * Requiring the rejected version to equal what this setup actually sent keeps
+ * an unrelated or stale response from changing later requests.
+ */
+export declare function parseClaudeCodeVersionRejection(body: string, reportedVersion: string): ClaudeCodeVersionRejection | undefined;
+/**
+ * Inspect a clone so the provider still receives the original response body.
+ * Any malformed, oversized, non-JSON, or non-400 response is ignored.
+ */
+export declare function detectClaudeCodeVersionRejection(response: Response, reportedVersion: string): Promise<ClaudeCodeVersionRejection | undefined>;

package/dist/version-rejection.js

@@ -0,0 +1,75 @@
+import { contentLength, readBoundedText } from "./bounded.js";
+import { compareClaudeCodeVersions, isValidClaudeCodeVersion, } from "./config.js";
+const VERSION_TOO_OLD_CODE = 'claude_code_version_too_old';
+const MAX_REJECTION_BODY_BYTES = 16 * 1024;
+const MAX_REJECTION_MESSAGE_LENGTH = 1024;
+const VERSION_REJECTION_PATTERN = /^Claude Code ([0-9.]{1,64}) does not support this model; version ([0-9.]{1,64}) or newer is required\./;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+/**
+ * Parse only Anthropic's structured minimum-version rejection.
+ *
+ * The error code is authoritative; the bounded message supplies the versions.
+ * Requiring the rejected version to equal what this setup actually sent keeps
+ * an unrelated or stale response from changing later requests.
+ */
+export function parseClaudeCodeVersionRejection(body, reportedVersion) {
+    if (body.length > MAX_REJECTION_BODY_BYTES)
+        return undefined;
+    let decoded;
+    try {
+        decoded = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(decoded) || decoded.type !== 'error')
+        return undefined;
+    const error = decoded.error;
+    if (!isRecord(error) || error.type !== 'invalid_request_error') {
+        return undefined;
+    }
+    const details = error.details;
+    if (!isRecord(details) || details.error_code !== VERSION_TOO_OLD_CODE) {
+        return undefined;
+    }
+    if (typeof error.message !== 'string' ||
+        error.message.length > MAX_REJECTION_MESSAGE_LENGTH) {
+        return undefined;
+    }
+    const match = VERSION_REJECTION_PATTERN.exec(error.message);
+    if (!match)
+        return undefined;
+    const rejectedVersion = match[1];
+    const requiredVersion = match[2];
+    if (!rejectedVersion ||
+        !requiredVersion ||
+        !isValidClaudeCodeVersion(rejectedVersion) ||
+        !isValidClaudeCodeVersion(requiredVersion) ||
+        rejectedVersion !== reportedVersion ||
+        compareClaudeCodeVersions(requiredVersion, reportedVersion) !== 1) {
+        return undefined;
+    }
+    return { rejectedVersion, requiredVersion };
+}
+/**
+ * Inspect a clone so the provider still receives the original response body.
+ * Any malformed, oversized, non-JSON, or non-400 response is ignored.
+ */
+export async function detectClaudeCodeVersionRejection(response, reportedVersion) {
+    if (response.status !== 400)
+        return undefined;
+    const declaredLength = contentLength(response.headers);
+    if (declaredLength !== undefined &&
+        declaredLength > MAX_REJECTION_BODY_BYTES) {
+        return undefined;
+    }
+    try {
+        const body = await readBoundedText(response.clone().body, MAX_REJECTION_BODY_BYTES, 'Anthropic version rejection');
+        return parseClaudeCodeVersionRejection(body, reportedVersion);
+    }
+    catch {
+        return undefined;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ex-machina/opencode-anthropic-auth",
-  "version": "2.0.0-next.2",
+  "version": "2.0.0-next.3",
   "type": "module",
   "repository": {
     "type": "git",